mirror/gettext
1
0
Fork 0
mirror of https://https.git.savannah.gnu.org/git/gettext.git synced 2026-01-26 15:39:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

libcroco: Fix double-free and free-after-use bug.

Browse Source 
Reported by Coverity.

* libtextstyle/gnulib-local/lib/libcroco/cr-sel-eng.c
(cr_sel_eng_unregister_pseudo_class_sel_handler): Don't access or free 'elem'
after it has been freed. Remove always-NULL variable.
This commit is contained in:
Bruno Haible 2025-08-03 20:02:26 +02:00
parent 6fa3d8eca2
commit ae52c096d7
1 changed files with 4 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libtextstyle/gnulib-local/lib/libcroco/cr-sel-eng.c
View File

@ -1,7 +1,7 @@
/* -*- Mode: C; indent-tabs-mode:nil; c-basic-offset: 8-*- */
/* libcroco - Library for parsing and applying CSS
* Copyright (C) 2006-2019 Free Software Foundation, Inc.
* Copyright (C) 2006-2025 Free Software Foundation, Inc.
*
* This file is not part of the GNU gettext program, but is used with
* GNU gettext.
@ -1206,8 +1206,7 @@ cr_sel_eng_unregister_pseudo_class_sel_handler (CRSelEng * a_this,
guchar * a_name,
enum CRPseudoType a_type)
{
GList *elem = NULL,
*deleted_elem = NULL;
GList *elem = NULL;
gboolean found = FALSE;
struct CRPseudoClassSelHandlerEntry *entry = NULL;
@ -1224,13 +1223,11 @@ cr_sel_eng_unregister_pseudo_class_sel_handler (CRSelEng * a_this,
}
if (found == FALSE)
return CR_PSEUDO_CLASS_SEL_HANDLER_NOT_FOUND_ERROR;
PRIVATE (a_this)->pcs_handlers = g_list_delete_link
(PRIVATE (a_this)->pcs_handlers, elem);
entry = elem->data;
if (entry->name)
g_free (entry->name);
g_free (elem);
g_list_free (deleted_elem);
PRIVATE (a_this)->pcs_handlers =
g_list_delete_link (PRIVATE (a_this)->pcs_handlers, elem); /* free()s elem ! */
return CR_OK;
}